User interface for controlling use of a business environment on a mobile device

ABSTRACT

A graphical user interface to provision business environments on mobile devices presents a navigation panel that displays a virtual phone template menu item and a policy setting menu item. Upon selection of the virtual phone template menu item, a template user interface is presented that enables an administrator to customize virtual phone image templates for users to be delivered to mobile devices that are configured to run the virtual phone image templates as virtual machines on the mobile devices in order to provide a business environment. Upon selection of the policy setting menu item, a policy user interface is presented that enables the administrator to set security policies, wherein each of the security policies specifies a time interval within which a mobile device running a virtual machine corresponding to one of the virtual phone image templates should communicate with an enterprise server to comply with the security policy.

CROSS REFERENCE TO RELATED APPLICATIONS

This application claims the benefit of U.S. Provisional PatentApplication 61/562,979 filed on Nov. 22, 2011 and entitled “ProvisioningWork Environments on Personal Mobile Devices” (Attorney Docket No.A838.PRO), which is hereby incorporated by reference. This applicationis also related to the patent applications entitled “Provisioning WorkEnvironments on Personal Mobile Devices” (Attorney Docket No. A838.01)and “Controlling Use of a Business Environment on a Mobile Device”(Attorney Docket No. A838.02), all of which are assigned to the assigneeof this application and have been filed on the same day as thisapplication.

BACKGROUND

Over the past decade, enterprises have experienced a substantialincrease in the productivity of its workforce when providing them withbusiness mobile devices. In the past, given their high cost, businessmobile devices were mainly allocated to management and focused onproviding employees with email access and cellular phone capabilities.However, recent improvements in the computing power, mobile displaytechnologies and connection speeds of mobile devices, combined with thecontinued decreases in hardware costs, have made powerful mobile devicesavailable even to the general public for personal use. More and moreindividuals personally own powerful mobile devices, such as smartphones,that, in addition to serving as a cellular phone, can be used in many ofthe same ways as a desktop or a laptop, such as accessing emails,browsing documents or the internet, game playing, listening to audio orviewing a video, and personal information management (PIM).

Due to the above trends in mobile devices, enterprises are currentlyexperiencing an “invasion” of personal devices into the workplace. Giventhe sophisticated capabilities of their personal mobile devices,employees no longer desire possessing a separate personal and businessmobile device and continually pressure information technology (IT)departments to support personal devices brought into the workplace. Assuch, IT departments struggle to maintain a proper balance betweenenabling a certain level of access to enterprise data (e.g., such asaccess to email, contacts, documents, and the like) on personal devicesand ensuring adequate security measures to protect corporateintellectual property in such enterprise data. This phenomenon has ledenterprises to investigate the viability of a “Bring Your Own Device”(BYOD) strategy to IT, where a personal mobile device is provisioned byIT departments with the capability of operating as a complete businessmobile device in a secure fashion.

Such a BYOD strategy could significantly decrease IT costs (e.g., byeliminating or reducing the need to purchase and provision hardwaredevices) and provide mobile enterprise access to many more employeesthan was previously possible (e.g., due to cost concerns), therebyachieving greater increases in productivity than before. However,significant challenges arise in provisioning “work environment” on apersonal mobile device that maintains adequate security and datapartitioning between the employee's “personal world” and the employer's“business world.”

SUMMARY

One or more embodiments of the invention provide virtualization as thesolution for consolidating personal and business uses in a single mobiledevice. One feature of virtualization is that it preserves isolation ofthe personal and work environments. As a result, the user need notprovide enterprise IT departments any control of the user's personalenvironment and the enterprise IT departments can retain strict controlof the user's work environment. Another feature of virtualization isthat the user's work environment will be platform independent. In otherwords, regardless of the type of personal mobile device the userchooses, the resulting business mobile device through virtualizationwill be identical. Therefore, enterprise IT departments need to supportonly one type of business mobile device.

One method for providing a graphical user interface to provisionbusiness environments on mobile devices, according to one or moreembodiments of the invention, comprises presenting a navigation panelthat displays a virtual phone template menu item and a policy settingmenu item. Upon selection of the virtual phone template menu item, atemplate user interface is presented in a display panel that enables anadministrator to customize virtual phone image templates for users in anenterprise to be delivered to mobile devices that are configured to runthe virtual phone image templates as virtual machines on the mobiledevices in order to provide a business environment. Upon selection ofthe policy setting menu item by the administrator, a policy userinterface is presented in the display panel that enables theadministrator to set security policies corresponding to the virtualphone image templates, wherein each of the security policies specifies atime interval within which a mobile device running a virtual machinecorresponding to one of the virtual phone image templates shouldcommunicate with an enterprise server to comply with the securitypolicy.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is an illustration of an example use case in which embodimentsmay be practiced.

FIG. 2 depicts an embodiment of a mobile management platform that may beutilized by an IT department to provision a business mobile device on apersonal mobile device 100.

FIGS. 3A-3E depict embodiments of an administrator user interface of aadministration service for provisioning a business mobile device on apersonal mobile device.

FIG. 4 depicts an internal system architecture of a personal mobiledevice that supports a business mobile device according to anembodiment.

FIG. 5 is a flow that illustrates a process for provisioning a virtualphone image for a business mobile device on a personal mobile device.

FIG. 6 is a flow that illustrates a process for establishing leasingcommunications between a mobile management platform server and apersonal mobile device.

DETAILED DESCRIPTION

FIG. 1 is an illustration of an example use case in which embodimentsmay be practiced. As depicted, an IT department 115 of an enterprise 110may provide the capability to “provision” a software-based businessmobile device 105 that runs on an employee's personal mobile device 100.Such provisioning (e.g., delivery of business mobile device 105 topersonal mobile device 100) may be performed “over-the-air” through awireless network (e.g., WiFi network, etc.), cellular network 120 orcombination thereof. In certain embodiments, as described herein, such asoftware-based business mobile device 105 takes the form of a virtualmachine that runs on top of a software virtualization layer (alsosometimes referred to herein as a hypervisor) supported by the “host”operating system (e.g., Android™, iOS™, Symbian™, webOS™, etc.) ofpersonal mobile device 100 (such virtual machine sometimes also referredto herein as a “virtual phone”).

FIG. 2 depicts an embodiment of a mobile management platform that may beutilized by IT department 115 to provision a business mobile device onpersonal mobile device 100. As depicted, a mobile management platformserver 200 (e.g., software-based) is installed on a computer system ofIT department 115 and provides a number of functional components.Through human interface devices (e.g. mouse, keyboard, touchscreen,etc.), an administrator can interact with an admin user interface 205 toaccess an admin service component 210, which, as further discussedbelow, offers a variety of services to assist the administrator inprovisioning a business mobile device 105 on a personal mobile device100. As depicted in the embodiment of FIG. 2, admin service component210 may further include a virtual phone provisioning service component215 that establishes a connection (e.g., wireless) with personal mobiledevice 100 in order to deliver a virtual phone image for business mobiledevice 105 to personal mobile device 100 and a virtual phone leasingservice component 220 that periodically communicates (e.g., wirelessly)over time with personal mobile device 100 (e.g., once business mobiledevice 105 has been installed on personal mobile device 100), forexample, in order to ensure compliance with certain security policiesregarding the user's ability to access an installed business mobiledevice 105 or to provide updates to the virtual phone image of businessmobile device 105. Admin service component 210 accesses a mobilemanagement database 225 in order to manage and store, for example, userprofiles, group profiles (e.g., business groups of an enterprise, suchas sales, marketing, legal, finance, engineering, etc.), business mobiledevice policies (as further described below), virtual phone images forbusiness mobile devices, mobile applications that may be included invirtual phone images, etc. In one embodiment, mobile management database225 may comprise a relational database to store user profiles, groupsprofiles and business mobile device policies as well as a file systembased repository to store various virtual phone images and mobileapplications.

FIGS. 3A-3E depict embodiments of an admin user interface 205 of anadmin service 210. In one embodiment, admin user interface 205 and adminservice 210 are implemented as a web application accessible through aweb browser although alternative embodiments may be implementeddifferently, including, for example, as a standalone client-sideapplication. FIG. 3A illustrates an embodiment of an initial “dashboard”view that is displayed, for example, when an administrator initiallylogs into admin service 210 through admin user interface 205. The leftside of FIG. 3A provides a navigation panel enabling an administrator tomanage and view various settings relating to users that have beenprovisioned with business mobile devices, business group configurationsfor business mobile devices, policy settings for business mobiledevices, various virtual phone images for business mobile devices,mobile applications that can be provisioned to business mobile devicesand other configuration information. As illustrated, the dashboard'smain view provides an overview of recent administration activities (e.g.“activity feed”) and other usage statistics. FIG. 3B illustrates a userview displaying information relating to users who have been provisioneda business mobile device by mobile management server 200. As FIG. 3Bdepicts, users may be organized into a variety of business groups ororganizations within enterprise 110, such as sales, marketing, finance,legal, engineering and the like. As further described below, in certainembodiments, such business groups are able to set their own defaultpolicies and default virtual phone images for users in their groups. Theuser view of FIG. 3B also indicates a status of the business mobiledevice 105 provisioned by admin service 210 to each user. Such status ofa user's business mobile device may be, for example, active, inactive,locked, wiped, pending installation, and the like. In certainembodiments of this user view and as further described below, anadministrator is able to request that mobile management platform 200(e.g., via virtual phone leasing component 215, etc.) “wipe” aparticular user's business mobile device 105 from the personal mobiledevice 100 (e.g., delete the virtual phone image or otherwise remove thefunctionality of business mobile device 105), for example, when suchuser has left enterprise 110 and is no longer an employee. It should berecognized that such a wiping of business mobile device 105 does notaffect the user's ability to use personal mobile device 100. FIG. 3Cillustrates a group view displaying information relating to businessmobile devices configured for a particular business group withinenterprise 110, such as the sales group. As depicted, the group view ofFIG. 3C displays a business mobile device policy that has been set forthe sales group (i.e., the “default policies set”) as well as a virtualphone image that has been set for the sales group (i.e., the “defaultvirtual phone template”). The group view of FIG. 3C further displaysusers belonging to the sales group who have been provisioned a businessmobile device as well as enables the administrator to create, store andmodify new and existing groups.

FIG. 3D illustrates an embodiment of a policy setting view of admin userinterface 210. As depicted, the policy setting view of FIG. 3D enablesan administrator to view, create, store and modify different policiesfor managing business mobile devices. Such policies, for example and asillustrated in FIG. 3D, may include “lease” renewal settings includingan “interval” setting defining how often virtual phone leasing service220 and personal mobile device 100 attempt to establish communications,an “auto disable” time period setting, expiration (e.g., time periodexpires without an intervening interval communication with virtual phoneleasing service 220) of which may trigger personal mobile device 100 totemporarily disable business mobile device 105 (e.g., putting businessmobile device 105 into a “locked” state that prevents a user fromutilizing business mobile device 105 until a successful communication bypersonal mobile device 110 with virtual phone leasing service 220), an“auto wipe” time period setting, expiration (e.g., time period expireswithout an intervening interval communication with virtual phone leasingservice 220) of which may trigger personal mobile device to permanently“wipe,” deactivate or otherwise remove business mobile device 105 frompersonal mobile device 100, etc. Other security related policy settingsmay also be configured in the policy setting view of FIG. 3D including,for example, whether a password is required to access business mobiledevice 105, the type and strength of the password (PIN, etc.),expiration periods for passwords, length of inactivity time beforebusiness mobile device 105 presents a lock screen, amount of retriesbefore business mobile device 105 locks, etc. Other policy settings inembodiments may include whether business mobile device 105 may beaccessible by VPN, whether a debugging mode can be set on businessmobile device 105 to assist an administrator to troubleshoot issues,whether data can be cut and paste and shared between personal mobiledevice 100 and business mobile device 100, and the like.

FIG. 3E illustrates an embodiment of a virtual phone image view ofadministrator user interface 210. Through this view, an administrator isable to view, create, store and modify base virtual phone images forbusiness mobile devices (e.g., according to requirements of differentbusiness groups in enterprise 110) that can be delivered to personalmobile device 100. Such a base image or “template” may include aselected mobile “guest” operating system (e.g., Android, iOS, Symbian,webOS, etc.), selected default user settings or customizations for themobile operations system (e.g., wallpaper, shortcuts, sounds, securitysettings, network settings, third part service synchronization settings,etc.), selected installed default mobile applications, and the like.FIG. 3A also illustrates additional views accessible from the left sidenavigation panel that an administrator may desire to select in order tomanage business mobile device activity. For example, the “work phoneimages” button enables the administrator to view current virtual phoneimages that have been uploaded into mobile management database 225 aswell as to upload new virtual phone images. Similarly, the“applications” button enables the administrator to view current mobileapplications that have been uploaded into mobile management database 225and may be added to an existing or new virtual phone template. Such anapplications view may further enable the administrator to uploadadditional mobile applications from third party sources such as variousthird party application stores (e.g., Android Market, Apple App Store,Amazon Appstore, carrier applications stores, etc.). The “configuration”button may enable the administrator to view currently scheduled jobsthat have been scheduled by the administrator (e.g., delivery of virtualphone images to personal mobile devices, updates to existing virtualphone images that have already been installed on personal mobiledevices, requests to wipe virtual phone images from personal mobiledevices, etc.), a list of administrators in IT department 115 and otherconfiguration information.

It should be recognized that the views of FIGS. 3A-3E are merelyexemplary and that alternative embodiments of admin user interface 205and admin service 210 may implement different user interfaces withdifferent design decisions that offer different management functionsthan those depicted in FIGS. 3A-3E. For example, embodiments ofadministration service 210 may further provide an administrator acapability to maintain a menu of “a la carte” mobile applications thatcan be separately provisioned to a particular user's business mobiledevice 105, for example, upon request of such user and separate from anydefault mobile applications that are included in virtual phone images.

FIG. 4 depicts an internal system architecture of personal mobile device100 that supports a business mobile device according to an embodiment.Personal mobile device 100 includes a firmware operation system (OS)400, such as Android, iOS, Symbian, webOS, etc. In the embodiment ofFIG. 4, a virtual phone “enabler” component 405 is embedded intofirmware OS 400. Because it is embedded into firmware OS 400, enablercomponent 405 is able to execute certain of its functions in privilegedmodes (e.g., superuser, root access, etc.) that are typically reservedfor functions of firmware OS 400. For example, in one embodiment, upon alaunch of business mobile device 105 by a user (e.g., by selecting a“work phone” icon displayed on personal mobile device 100, etc.),enabler component 405 loads a virtual phone image for business mobiledevice 105 into the memory of personal mobile device 100 and dedicates athread for the execution of a virtual machine for business mobile device105. During execution of the virtual machine for business mobile device105, other portions of enabler component 405 may then generally supportthe transfer of control between firmware OS 400 and business mobiledevice 105 (sometimes referred to as “world switching”). In addition tothe foregoing, in certain embodiments, portions of enabler component 405may further assist with issues such as memory allocation, timers, powermanagement, communications between a hypervisor 415 (as furtherdiscussed below) running on top of firmware OS 400 and a virtualhardware platform (sometimes referred to herein as a “virtual machinemonitor”) of the virtual machine for business mobile device 105,enabling networking capabilities (e.g., TCP/IP, IPv4/IPv6, etc.) for thevirtual machine of business mobile device 105 and the like. In oneembodiment, enabler component 405 is embedded into firmware OS 400 by amobile device manufacturer or a carrier 430, such that a personal mobiledevice 100 purchased by a user (e.g. via generally available methodssuch as carrier stores, electronics stores, consumer goods stores,ecommerce web sites, etc.) already includes enabler component 405.

A personal mobile device 100 having firmware OS 400 that includesenabler component 405 is able support a mobile application package 410that comprises a variety of functional components such as a hypervisor415, a provisioning tool 420 and a management service 422. In oneembodiment, a user may download mobile application package 410 from amobile application store 435 such as the Android Market, Apple AppStore, Amazon Appstore, etc. For example, such a mobile applicationpackage 410 may take the form of a .apk file if downloaded from theAndroid Market. Once downloaded and installed on the host OS of personalmobile device 100, mobile application package 410 authenticates andbinds itself to enabler component 405, thereby enabling the variousfunctional components of mobile application package to execute in higherprivileged and/or secured modes. Hypervisor 415 is a virtualizationlayer running on top of firmware OS 400 which provides necessaryservices to enable execution of a virtual machine for business mobiledevice 105. In one embodiment, the guest OS included in a virtual phoneimage 425 for business mobile device 105 includes “paravirtualized”guest drivers for each device of personal mobile device 100 that enablesa virtual hardware layer (or virtual machine monitor) of the virtualmachine to intercept hypercalls for device specific behavior and forwardsuch hypercall requests as needed to hypervisor 415, which in turnfacilitates communication with the actual hardware devices of personalmobile device 10. It should be recognized that alternative embodimentsmay utilize a non-paravirtualized implementation where guest drivers andthe guest OS of virtual phone image 425 may be unaware that they arerunning on top of a virtualization layer. As further depicted in FIG. 4,mobile application package 410 also includes a provisioning tool 420that may, for example, provide a user interface and other supportservices to assist a user in retrieving virtual phone image 425 andother configuration information (e.g., policy configurations, additionalmobile applications, etc.) from virtual phone provisioning service 215of mobile management server 200 in IT department 115. Mobile application410 further includes a management service 422 that once installed,continuously runs as a service on the host OS and periodicallycommunicates with virtual phone leasing service, for example, in orderto comply with various security policy settings for business mobiledevice 105 or to provide various updates (e.g., OS updates,customizations, new applications, etc.) to virtual phone image 425 ofbusiness mobile device 105. In one embodiment, because managementservice 422 is able to run in a higher privilege or security level dueto its binding to enabler component 405, it cannot be manuallyterminated by the user of personal mobile device 100 (e.g., without suchuser obtaining root access, etc.).

FIG. 5 is a flow that illustrates a process for provisioning virtualphone image 425 for business mobile device 105 on personal mobile device100. In step 500, a user purchases personal mobile device 100 includingfirmware OS 400 that includes enabler component 405. In step 505, theuser, for example, using a mobile app store application alreadyinstalled on personal mobile device 100 (or through alternativedownloading means), purchases or otherwise downloads and installs mobileapplication package 410 on the host OS of personal mobile device 100.Upon installation of mobile application package 410, in step 510, theuser launches provisioning tool 420 of mobile application package 410.In one embodiment, provisioning tool 420 provides a user interface tothe user to input information into provisioning tool 420 that enablesprovisioning tool 420 to establish a connection (e.g., wireless) tovirtual phone provisioning service 215. For example, an administrator ofIT department may, via an out-of-band channel (e.g., orally, email,support ticket, etc.), provide the user a URL to input into provisioningtool 240 which identifies a network address (e.g., and listening port)of mobile management platform 200 and/or unique identifying information(e.g., user ID, etc.) that virtual phone provisioning service 215 canutilize to match a virtual phone image 425 that corresponds to the user.Alternatively, a user may alternatively provide such unique identifyinginformation (e.g., enterprise username and password, etc.) toprovisioning tool 420 or provisioning tool 420 may extract such a uniqueidentifying information from personal mobile device 100 itself (e.g.,user's cell phone number, etc.). Upon receipt of such unique identifyinginformation from provisioning tool 420, virtual phone provisioningservice 215 is able to identify a virtual phone image 425 thatcorresponds to the user. In an alternative embodiment, virtual phoneprovisioning service 215 may utilize push methodologies to transmit apush message to personal mobile device 100 that wakes-up provisioningtool 420 on personal mobile device 100 in order to establish aconnection back to virtual phone provisioning service 215. In one suchembodiment, such a push message may include unique identifyinginformation corresponding to the user which provisioning tool 420 cantransmit back to virtual phone provisioning service 215 to enablevirtual phone provisioning service 215 to identify a virtual phone image425 corresponding to the user (or alternatively, provisioning tool 420can prompt the user for such unique identifying information, such as ausername and password or extract such unique identifying informationfrom personal mobile device 100, such as a cell phone number).

In step 515, provisioning tool 420, as described above, establishes aconnection (e.g., wireless) with virtual phone provisioning service 215and provides the unique identifying information to virtual phoneprovisioning service 215 to identify a virtual phone image 425corresponding to the user. In step 520, virtual phone provisioningservice 215 receives the unique identifying information and, in step525, dynamically generates or otherwise identifies a previously storeddefault virtual phone image 425 corresponding to the unique identifyinginformation (and thus, the user). For example, in one embodiment,virtual phone provisioning service 215 determines an identity of theuser from the received unique identifying information and is able toidentify a default virtual phone image 425 stored in a file systemrepository of mobile management database 225 that corresponds to thebusiness group of the user (see, e.g., FIG. 3C). In step 530, virtualphone provisioning service 215 transmits virtual phone image 425 toprovisioning tool 420. In one embodiment, such virtual phone image 425is transmitted as a zip file. In step 535, virtual phone provisioningservice 215 similarly identifies policy settings corresponding to theuser's business group (see, e.g., FIG. 3D) as well as any additionalmobile applications requested by the user (and supported by ITdepartment 115) that are not included in virtual phone image 425, and instep 540, transmits the policy setting and additional mobileapplications to provisioning tool 420. In one embodiment, communicationbetween virtual phone provisioning service 215 and provisioning tool 420during transmission of virtual phone image 425, business group policysettings, and additional mobile applications occurs through RESTful APIs(representational state transfer application programming interface). Insteps 545 and 550, provisioning tool 420 receives virtual phone image425, group policy settings and additional mobile applications,respectively. In one embodiment, provisioning tool 240 receives andstores virtual phone image 425, due to its size (e.g., 3 GBs or higherin some embodiments), on an external storage card of personal mobiledevice 100, such as an external microSD card or other similar small formfactor mass storage devices. Alternative embodiments may store virtualphone image 425 in the internal memory (e.g., NAND flash memory orembedded eMMC/eSD memory chips) of personal mobile device 100. In step555, provisioning tool 420 initializes business mobile device 105. Forexample, in one embodiment, during such initialization, provisioningtool 420 provides certain group policy settings received in step 550,such as lease settings, to management service 422 to initiate a periodic“leasing” communication with virtual phone leasing service 220 inaccordance with the lease settings for the user's business group (see,e.g., FIG. 3D). Similarly, provisioning tool 420 may provide other grouppolicy settings, such as password settings, to hypervisor 415 to enablehypervisor 415 to properly control password access to business mobiledevice 105. The initialization process may additionally install anyadditional mobile applications into virtual phone image 425. Onceinitialized, in step 560, the user may launch business mobile device 105in a virtual machine supported by hypervisor 415 using virtual phoneimage 425. Similarly, once virtual phone image 425 has been deliveredand installed on personal mobile device 100, at step 565, mobilemanagement platform 200 may update a user profile corresponding to theuser (see, e.g., FIG. 3B) to indicate that the user's business mobiledevice 105 has now been activated.

FIG. 6 is a flow that illustrates a process for establishing leasecommunications between a mobile management platform server 200 and apersonal mobile device 100. As previously discussed, in certainembodiments, once virtual phone image 425 has been delivered, stored andinstalled, management service 422 of mobile application package 410begins periodic “lease” communications with virtual phone leasingservice 220 of mobile management platform 200. In certain embodiments,for security purposes, management service 422 runs in a privileged modein the host OS of personal mobile device 100 such that managementservice 422 cannot be manually terminated by the user. In step 600,management service 422 initiates or starts a periodic timer for a leaseinterval, such as 12 hours (see, e.g., FIG. 3D). Upon expiration of thelease interval in step 605, management service 422 attempts to establisha connection with virtual phone leasing service 220. If, in step 610, aconnection is successfully established, then in step 615, managementservice 422 communicates with virtual phone leasing service 220 anddownloads any updates, changes and/or modifications to any settings forbusiness mobile device 105 and modifies virtual phone image 425,hypervisor 415 settings (e.g., password security settings for businessmobile device 105), management service 422 configuration settings (e.g.,lease settings) and/or other settings and configurations accordingly.Such updates, changes, and/or modifications may include, for example,instructions to wipe business mobile device 105 from personal mobiledevice 100 (e.g., due to the user no longer being an employee atenterprise 115), new mobile applications to install on business mobiledevice 105, instructions to remove existing mobile applications frombusiness mobile device 105, upgrades to the guest OS of business mobiledevice 105, changes to user settings and customizations for guest OS ofbusiness mobile device 105, changes to the group policy settings of theuser, changes to shared preferences for mobile applications, and thelike. In one embodiment, an administrator using mobile managementplatform server 200 may interact with user interface 205 to request anyof the foregoing updates, changes and/or modifications to businessmobile device 105, which are then queued until management service 422successfully establishes a connection with virtual phone leasing service220. After performing such updates, changes, and/or modifications bymanagement service 422, in step 620, management service 422 resets itsperiodic timer and returns to step 605.

If, however, in step 610, a connection is not successfully established(e.g., due to a malicious user who has stolen personal mobile device 100and turned off its wireless network capabilities), then in step 625, ifa time period for an auto-wipe setting (e.g., 4 days in FIG. 3D) haselapsed, then in step 630, management service 422 will permanentlydelete or otherwise remove virtual phone image 425 from personal mobiledevice 100 thereby permanently wiping the existence of business mobiledevice 105 from personal mobile device 100 for security purposes. Itshould be recognized that the wiping of business mobile device 105 frompersonal mobile device 100 does not affect a user's ability to usepersonal mobile device 100. If, the time period for auto-wipe has notelapsed, then, in step 635, if a time period for an auto-disable setting(e.g., 1 day in FIG. 3D) has elapsed, then, in step 640, managementservice 422 will temporarily disable access by the user to businessmobile device 105 until a connection with virtual phone leasing servicehas been re-established in step 610. It should be recognized that theflow of FIG. 6 for lease communications is merely exemplary and variousalternatives may be made consistent with the teachings herein. Forexample, while FIG. 6 describes a “polling” technique in whichmanagement service 422 running on personal mobile device 100 initiatesan attempt to establish communications with virtual phone leasingservice 220 of mobile management platform 200, alternative embodimentsmay employ a push model, whereby virtual phone leasing service 220utilizes a periodic timer to transmit push messages to managementservice 422 on personal mobile device 100 to request management service422 to connect back to virtual phone leasing service 220.

Although one or more embodiments of the present invention have beendescribed in some detail for clarity of understanding, it will beapparent that certain changes and modifications may be made within thescope of the claims. For example, while embodiments herein have referredto certain mobile operating systems such as Android, it should berecognized that any mobile operating systems may be utilizing inalternative embodiments such as Apple's iOS, Research in Motion'sBlackberry OS, Microsoft's Windows Phone, Hewlett Packard's webOS,Symbian, Java, and the like. Similarly, while embodiments herein havegenerally utilized a smartphone as an example of a mobile device, itshould be recognized that any potable device that has primary purposesof providing mobile computing or mobile data services to a user mayutilize the techniques herein, including tablet computers and similarportable devices. It should further be recognized that use of certainterminology that may be more commonly used with certain operatingsystems than others is merely exemplary not meant to limit the scope ofthe teachings herein to any particular operating system and thatcorresponding functions and components in other operating systemplatforms may benefit from the teachings herein. Accordingly, thedescribed embodiments are to be considered as illustrative and notrestrictive, and the scope of the claims is not to be limited to detailsgiven herein, but may be modified within the scope and equivalents ofthe claims. In the claims, elements and/or steps do not imply anyparticular order of operation, unless explicitly stated in the claims.

The various embodiments described herein may employ variouscomputer-implemented operations involving data stored in computersystems. For example, these operations may require physical manipulationof physical quantities—usually, though not necessarily, these quantitiesmay take the form of electrical or magnetic signals, where they orrepresentations of them are capable of being stored, transferred,combined, compared, or otherwise manipulated. Further, suchmanipulations are often referred to in terms, such as producing,identifying, determining, or comparing. Any operations described hereinthat form part of one or more embodiments of the invention may be usefulmachine operations. In addition, one or more embodiments of theinvention also relate to a device or an apparatus for performing theseoperations. The apparatus may be specially constructed for specificrequired purposes, or it may be a general purpose computer selectivelyactivated or configured by a computer program stored in the computer. Inparticular, various general purpose machines may be used with computerprograms written in accordance with the teachings herein, or it may bemore convenient to construct a more specialized apparatus to perform therequired operations.

The various embodiments described herein may be practiced with othercomputer system configurations including hand-held devices,microprocessor systems, microprocessor-based or programmable consumerelectronics, minicomputers, mainframe computers, and the like.

One or more embodiments of the present invention may be implemented asone or more computer programs or as one or more computer program modulesembodied in one or more computer readable media. The term computerreadable medium refers to any data storage device that can store datawhich can thereafter be input to a computer system—computer readablemedia may be based on any existing or subsequently developed technologyfor embodying computer programs in a manner that enables them to be readby a computer. Examples of a computer readable medium include a harddrive, network attached storage (NAS), read-only memory, random-accessmemory (e.g., a flash memory device), a CD (Compact Discs)—CD-ROM, aCD-R, or a CD-RW, a DVD (Digital Versatile Disc), a magnetic tape, andother optical and non-optical data storage devices. The computerreadable medium can also be distributed over a network coupled computersystem so that the computer readable code is stored and executed in adistributed fashion.

Virtualization systems in accordance with the various embodiments, maybe implemented as hosted embodiments, non-hosted embodiments or asembodiments that tend to blur distinctions between the two, are allenvisioned. Furthermore, various virtualization operations may be whollyor partially implemented in hardware. For example, a hardwareimplementation may employ a look-up table for modification of storageaccess requests to secure non-disk data.

Many variations, modifications, additions, and improvements arepossible, regardless the degree of virtualization. The virtualizationsoftware can therefore include components of a host, console, or guestoperating system that performs virtualization functions. Pluralinstances may be provided for components, operations or structuresdescribed herein as a single instance. Finally, boundaries betweenvarious components, operations and data stores are somewhat arbitrary,and particular operations are illustrated in the context of specificillustrative configurations. Other allocations of functionality areenvisioned and may fall within the scope of the invention(s). Ingeneral, structures and functionality presented as separate componentsin exemplary configurations may be implemented as a combined structureor component. Similarly, structures and functionality presented as asingle component may be implemented as separate components. These andother variations, modifications, additions, and improvements may fallwithin the scope of the appended claims(s).

What is claimed is:
 1. A method for providing a graphical user interfaceto provision business environments on mobile devices, the methodcomprising: presenting a navigation panel that displays a virtual phonetemplate menu item and a policy setting menu item; upon selection of thevirtual phone template menu item, presenting a template user interfacein a display panel that enables an administrator to customize virtualphone image templates for users in an enterprise to be delivered tomobile devices that are configured to run the virtual phone imagetemplates as virtual machines on the mobile devices in order to providea business environment; and upon selection of the policy setting menuitem by the administrator, presenting a policy user interface in thedisplay panel that enables the administrator to set security policiescorresponding to the virtual phone image templates, wherein each of thesecurity policies specifies a time interval within which a mobile devicerunning a virtual machine corresponding to one of the virtual phoneimage templates should communicate with an enterprise server to complywith the security policy.
 2. The method of claim 1, wherein thenavigation panel further displays a groups menu item and the methodfurther comprises, upon selection of the groups menu items, presenting agroups user interface in the display panel that enables theadministrator to organize the users into business groups.
 3. The methodof claim 1, wherein the policy user interface displays a configurablesetting for a virtual phone disable time interval for a security policy,wherein upon expiration of the virtual phone disable time interval on amobile device without an intervening communication with the enterpriseserver, the mobile device is configured to disable access to a virtualmachine running on the mobile device.
 4. The method of claim 1, whereinthe policy user interface displays a configurable setting for a virtualphone delete time interval for a security policy, wherein uponexpiration of the virtual phone delete time interval on a mobile devicewithout an intervening communication with the enterprise server, themobile device is configured to remove a virtual phone image templatefrom the mobile device.
 5. The method of claim 1, wherein the policyuser interface displays configurable settings for user authenticationrequirements to access a virtual machine running on a mobile device. 6.The method of claim 1, wherein the template user interface displays apanel that enables the administrator to add applications to a virtualphone image template.
 7. The method of claim 1, wherein the navigationpanel further displays a users menu item and the method furthercomprises, upon selection of the users menu items, presenting a userinterface in the display panel that displays an activation status of avirtual phone template image for users in the enterprise.
 8. A serverconfigured to providing a graphical user interface to provision businessenvironments on mobile devices, the server comprising a processorconfigured to perform the steps of: presenting a navigation panel thatdisplays a virtual phone template menu item and a policy setting menuitem; upon selection of the virtual phone template menu item, presentinga template user interface in a display panel that enables anadministrator to customize virtual phone image templates for users in anenterprise to be delivered to mobile devices that are configured to runthe virtual phone image templates as virtual machines on the mobiledevices in order to provide a business environment; and upon selectionof the policy setting menu item by the administrator, presenting apolicy user interface in the display panel that enables theadministrator to set security policies corresponding to the virtualphone image templates, wherein each of the security policies specifies atime interval within which a mobile device running a virtual machinecorresponding to one of the virtual phone image templates shouldcommunicate with an enterprise server to comply with the securitypolicy.
 9. The server of claim 8, wherein the navigation panel furtherdisplays a groups menu item and the processor is further configured toperform the step of, upon selection of the groups menu items, presentinga groups user interface in the display panel that enables theadministrator to organize the users into business groups.
 10. The serverof claim 8, wherein the policy user interface displays a configurablesetting for a virtual phone disable time interval for a security policy,wherein upon expiration of the virtual phone disable time interval on amobile device without an intervening communication with the enterpriseserver, the mobile device is configured to disable access to a virtualmachine running on the mobile device.
 11. The server of claim 8, whereinthe policy user interface displays a configurable setting for a virtualphone delete time interval for a security policy, wherein uponexpiration of the virtual phone delete time interval on a mobile devicewithout an intervening communication with the enterprise server, themobile device is configured to remove a virtual phone image templatefrom the mobile device.
 12. The server of claim 8, wherein the policyuser interface displays configurable settings for user authenticationrequirements to access a virtual machine running on a mobile device. 13.The server of claim 8, wherein the template user interface displays apanel that enables the administrator to add applications to a virtualphone image template.
 14. The server of claim 8, wherein the navigationpanel further displays a users menu item and the processor is furtherconfigured to perform the step of, upon selection of the users menuitems, presenting a user interface in the display panel that displays anactivation status of a virtual phone template image for users in theenterprise.
 15. A computer readable storage medium comprisinginstructions that cause a processor of a server to provide a graphicaluser interface to provision business environments on mobile devices byperforming the steps of: presenting a navigation panel that displays avirtual phone template menu item and a policy setting menu item; uponselection of the virtual phone template menu item, presenting a templateuser interface in a display panel that enables an administrator tocustomize virtual phone image templates for users in an enterprise to bedelivered to mobile devices that are configured to run the virtual phoneimage templates as virtual machines on the mobile devices in order toprovide a business environment; and upon selection of the policy settingmenu item by the administrator, presenting a policy user interface inthe display panel that enables the administrator to set securitypolicies corresponding to the virtual phone image templates, whereineach of the security policies specifies a time interval within which amobile device running a virtual machine corresponding to one of thevirtual phone image templates should communicate with an enterpriseserver to comply with the security policy.
 16. The computer readablestorage medium of claim 15, wherein the navigation panel furtherdisplays a groups menu item and the instruction further configure theprocessor to perform the step of, upon selection of the groups menuitems, presenting a groups user interface in the display panel thatenables the administrator to organize the users into business groups.17. The computer readable storage medium of claim 15, wherein the policyuser interface displays a configurable setting for a virtual phonedisable time interval for a security policy, wherein upon expiration ofthe virtual phone disable time interval on a mobile device without anintervening communication with the enterprise server, the mobile deviceis configured to disable access to a virtual machine running on themobile device.
 18. The computer readable storage medium of claim 15,wherein the policy user interface displays a configurable setting for avirtual phone delete time interval for a security policy, wherein uponexpiration of the virtual phone delete time interval on a mobile devicewithout an intervening communication with the enterprise server, themobile device is configured to remove a virtual phone image templatefrom the mobile device.
 19. The computer readable storage medium ofclaim 15, wherein the policy user interface displays configurablesettings for user authentication requirements to access a virtualmachine running on a mobile device.
 20. The computer readable storagemedium of claim 15, wherein the template user interface displays a panelthat enables the administrator to add applications to a virtual phoneimage template.